The present invention relates to devices that communicate over a wireless mesh network. In particular, the present invention relates to automatic and secure loading of encryption keys into devices prior to the devices joining a wireless mesh network.
Wireless data communication and control will be a dominant player in future sensor automation, process control, security, and safety regulation. One of the important requirements for wireless data communication and control is that the devices communicating over the network minimize power consumption.
In wireless mesh network systems designed for low power, sensor/actuator-based applications, many devices in the network must be powered by long-life batteries or by low power energy-scavenging power sources. Power outlets, such as 120VAC utilities, are typically not located nearby or may not be allowed into the hazardous areas where the instrumentation (sensors) and actuators must be located without incurring great installation expense. The need for low installation cost drives the need for battery-powered devices communicating as part of a wireless mesh network. Effective utilization of a limited power source, such as a primary cell battery which cannot be recharged, is vital for a well functioning wireless device. Batteries are expected to last more than 5 years and preferably as long as the life of the product.
In a true wireless mesh network, which may also be referred to as a self-organizing multi-hop network, each device must be capable of routing messages for itself as well as other devices in the network. The concept of messages hopping from node to node through the network is beneficial because lower power RF radios can be used, and yet the mesh network can span a significant physical area delivering messages from one end to the other. High power radios are not needed in a mesh network, in contrast a point-to-point system which employs remote devices talking directly to a centralized base-station.
A mesh network protocol allows for the formation of alternate paths for messaging between devices and between devices and a data collector, or a bridge or gateway to some higher level higher-speed data bus. Having alternate, redundant paths for wireless messages enhances data reliability by ensuring there is at least one alternate path for messages to flow even if another path gets blocked or degrades due to environmental influences or due to interference.
Some mesh network protocols are deterministically routed such that every device has an assigned parent and at least one alternate parent. In the hierarchy of the mesh network, much as in a human family, parents have children, children have grandchildren, and so on. Each device (or “node”) relays the messages for their descendants through the network to some final destination such as a gateway. The parenting devices may be battery-powered or limited-energy powered devices. The more descendants a node has, the more traffic it must route, which in turn directly increases its own power consumption and diminishes its battery life.
In order to save power, some protocols limit the amount of traffic any node can handle during any period of time by only turning on the radios of the nodes for limited amounts of time to listen for messages. Thus, to reduce average power, the protocol may allow duty-cycling of the radios between On and Off states. Some protocols use a global duty cycle to save power such that the entire network is On and Off at the same time. Other protocols (e.g. TDMA-based) use a local duty cycle where only the communicating pair of nodes that are linked together are scheduled to turn On and Off in a synchronized fashion at predetermined times. Typically, the link is pre-determined by assigning the pair of nodes a specific time slot for communications, an RF frequency channel to be used by the radios, who is to be receiving (Rx), and who is to be transmitting (Tx) at that moment in time.
Mesh networks use a process known as “joining” to incorporate new devices into the secured network. During the joining process, a number of information exchanges and configurations take place.
The new device uses a network predetermined channel to discover similar devices within radio range. These are the existing network nodes the new device has available to it in order to gain membership into the network. The presence of each device within range is recorded. The new device sends a message to establish a handshake protocol with a neighbor device, asks to join the network, and provides a device number and network ID. The neighbor communicates the request to a network manager, which for example may be a software program running on a network gateway or a server connected to the gateway. The new device will provide its “neighbor” list to the network manager so that the network manager can determine the links that must be established to allow the new device to participate in the network.
The new device receives a joining message from the network manager. The new device then sends back the expected response along with other information necessary for the network manager to establish links from the new device to other devices in the network.
The new device and its new parents and children receive and implement configuration information from the network manager to establish the required links. The new device is then fully joined and participating in the network.
For wireless mesh networks, communication security and ease of use are two important features. These two features can be at odds, because communication security implies complexity and an opportunity for things to go wrong.
In one approach used in wireless mesh networks, security is predicated on a symmetric join key mechanism. By loading the correct join key into a device, that device is then capable of communicating with its neighbors and the gateway of the mesh network in a secure way. In this approach, during the joining process, the message to the neighbor device is encrypted by the new device using its stored join key. If the new device has the wrong join key, the join request will be rejected by the neighbor and will not be sent on to the network manager. The new device also uses the join key to decode the joining message from the network manager. Other approaches to security are possible that do not require a symmetric join key mechanism. These other approaches make use of asymmetric or symmetric encryption keys or other cryptographic material stored in the devices to provide network security.
One challenge with wireless mesh networks is how to load cryptographic material (such as a join key or other symmetric or asymmetric keys) to the wireless device the first time. If the loading is done manually, human errors can occur. If the loading is done through wireless communication with the device, the communication is not secure, and another wireless device within range may be able to receive and possibly misuse the cryptographic material that was intended for the new device that is being loaded.